Buggy code:
private String charsetURIAttribute = ";charset=" ; private int encodingInfoNote ; private int decodedNote ; private int encodingSourceNote ; private int sessionEncodingNote ; private boolean normalize = true ; private boolean safe = true ; private boolean saveOriginal = false ; public DecodeInterceptor ( ) { } public void setDefaultEncoding ( String s ) { } public void setUseSessionEncoding ( boolean b ) { } public void setCharsetAttribute ( String s ) { } public void setNormalize ( boolean b ) { } public void setSaveOriginal ( boolean b ) { } public void setSafe ( boolean b ) { } public void engineInit ( ContextManager cm ) throws TomcatException { } private void normalizePath ( MessageBytes pathMB ) { } private boolean normalize ( ByteChunk bc ) { int start = bc . getStart ( ) ; int end = bc . getEnd ( ) ; byte [ ] buff = bc . getBytes ( ) ; int i = 0 ; int j = 0 ; boolean modified = false ; String orig = null ; if ( ( debug ) > 0 ) orig = new String ( buff , start , ( end - start ) ) ; for ( i = start , j = start ; i < ( end - 1 ) ; i ++ ) { if ( ( ( buff [ i ] ) == '//' ) && ( ( buff [ ( i + 1 ) ] ) == '//' ) ) { if ( ( ! ( ( i == ( start + 5 ) ) && ( bc . startsWith ( DecodeInterceptor . HTTP ) ) ) ) && ( ! ( ( i == ( start + 6 ) ) && ( bc . startsWith ( DecodeInterceptor . HTTPS ) ) ) ) ) { while ( ( i < ( end - 1 ) ) && ( ( buff [ ( i + 1 ) ] ) == '//' ) ) i ++ ; } } if ( i < ( end - 1 ) ) { buff [ ( j ++ ) ] = buff [ i ] ; } } if ( i != j ) { buff [ ( j ++ ) ] = buff [ ( end - 1 ) ] ; end = j ; bc . setEnd ( end ) ; modified = true ; if ( ( debug ) > 0 ) { log ( ( ( ( ( ( "Eliminate<seq2seq4repair_space>////<seq2seq4repair_space>" + orig ) + "<seq2seq4repair_space>" ) + start ) + "<seq2seq4repair_space>" ) + end ) ) ; } } for ( i = start , j = start ; i < ( end - 1 ) ; i ++ ) { if ( ( ( ( buff [ i ] ) == '.' ) && ( ( buff [ ( i + 1 ) ] ) == '//' ) ) && ( ( i == start ) || ( ( buff [ ( i - 1 ) ] ) == '//' ) ) ) { i += 1 ; if ( i == ( end - 1 ) ) j -- ; } else { buff [ ( j ++ ) ] = buff [ i ] ; } } if ( i != j ) { buff [ ( j ++ ) ] = buff [ ( end - 1 ) ] ; end = j ; bc . setEnd ( end ) ; modified = true ; if ( ( debug ) > 0 ) { log ( ( "Eliminate<seq2seq4repair_space>//.//<seq2seq4repair_space>" + orig ) ) ; } } j = end ; if ( ( end == ( start + 1 ) ) && ( ( buff [ start ] ) == '.' ) ) { end -- ; buff [ start ] = '//' ; } else if ( ( ( end >= ( start + 1 ) ) && ( ( buff [ ( end - 1 ) ] ) == '.' ) ) && ( ( buff [ ( end - 2 ) ] ) == '//' ) ) { end = end - 1 ; } if ( end != j ) { bc . setEnd ( end ) ; modified = true ; if ( ( debug ) > 0 ) { log ( ( "Eliminate<seq2seq4repair_space>ending<seq2seq4repair_space>//.<seq2seq4repair_space>" + orig ) ) ; } } for ( i = start , j = start ; i < ( end - 2 ) ; i ++ ) { if ( ( ( ( ( buff [ i ] ) == '.' ) && ( ( buff [ ( i + 1 ) ] ) == '.' ) ) && ( ( buff [ ( i + 2 ) ] ) == '//' ) ) && ( ( i == start ) || ( ( buff [ ( i - 1 ) ] ) == '//' ) ) ) { i += 1 ; j = j - 2 ; if ( j < start ) { j = start ; } while ( ( j > start ) && ( ( buff [ j ] ) != '//' ) ) { j -- ; } } else { buff [ ( j ++ ) ] = buff [ i ] ; } } if ( i != j ) { buff [ ( j ++ ) ] = buff [ ( end - 2 ) ] ; buff [ ( j ++ ) ] = buff [ ( end - 1 ) ] ; end = j ; bc . setEnd ( end ) ; modified = true ; if ( ( debug ) > 0 ) { log ( ( "Eliminate<seq2seq4repair_space>//..//<seq2seq4repair_space>" + orig ) ) ; } } j = end ; if ( ( ( ( end >= ( start + 3 ) ) && ( ( buff [ ( end - 1 ) ] ) == '.' ) ) && ( ( buff [ ( end - 2 ) ] ) == '.' ) ) && ( ( buff [ ( end - 3 ) ] ) == '//' ) ) { <START_BUG> end -= 4 ; <END_BUG> if ( end < start ) { end = start ; } while ( ( end > start ) && ( ( buff [ end ] ) != '//' ) ) end -- ; }

Fix:
end -= 3 ;